Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 181Question →

An administrator needs to enable the Cloud Vision API (`vision.googleapis.com`) for a Google Cloud project named `media-proc-prod` using the `gcloud` command-line tool. Place the following steps in the correct sequential order from first to last to complete this configuration and verification process under least-privilege principles.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, set the active gcloud project context to media-proc-prod. Second, ensure the administrator identity has the Service Usage Admin role granted on the target project. Third, execute gcloud services enable vision.googleapis.com. Finally, run gcloud services list --enabled to confirm the API activation.
The workflow follows standard Google Cloud management practices: first configure project context in the CLI, ensure required permissions are present on the target project, execute the enablement command, and finally verify the resulting state.

Step-by-Step Solution

1
Set the project context in gcloud CLI.
The CLI environment now directs subsequent service usage requests to `media-proc-prod`.
Prevents accidentally enabling APIs in the wrong project or organization node.
2
Verify IAM role assignment for API management.
The user identity holds `roles/serviceusage.serviceUsageAdmin` privileges.
API enablement requires explicit IAM permissions such as `serviceusage.services.enable`.
3
Enable the Cloud Vision API service.
Google Cloud enables `vision.googleapis.com` for project `media-proc-prod`.
Invokes the core operation to register the project with the specific service API.
4
List enabled services using `gcloud services list --enabled`.
Output contains `vision.googleapis.com`.
Confirms operational readiness before dependent application workloads are deployed.

Key Concept

API Enablement and Verification Workflow using gcloud CLI
Estimated Time:1m 30s
Question 182Question →

A Google Cloud administrator needs to migrate an existing project (`corp-analytics-prod`) from a legacy billing account to a newly established billing account (`01A2B3-4C5D6E-7F8901`) using the Google Cloud CLI (`gcloud`). The administrator has already been granted `roles/billing.projectManager` on the project and `roles/billing.user` on the target billing account. Which sequence of operations must the administrator execute to identify the new billing account ID, link the project to the new billing account, and verify the successful linkage?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order requires first discovering the target Cloud Billing account ID, then describing the project to record its baseline state, followed by running the link command with the target billing account ID, and finally running describe again to verify that the project billing account ID and billing status have updated.
The proper administrative workflow begins by listing accessible billing accounts to obtain the exact target billing account ID. Next, describing the project provides a baseline view of current billing settings. Running `gcloud billing projects link` applies the new billing account binding. Finally, re-describing the project confirms that the `billingAccountId` field reflects the new ID and that `billingEnabled` is set to `true`.

Step-by-Step Solution

1
Run `gcloud billing accounts list`
Returns all Cloud Billing accounts accessible by the current IAM identity, revealing the ID `01A2B3-4C5D6E-7F8901`.
You must obtain the exact billing account ID before attempting CLI binding operations.
2
Run `gcloud billing projects describe corp-analytics-prod`
Displays current project billing metadata including existing `billingAccountId` and `billingEnabled: true`.
Establishing a baseline state allows confirmation of existing billing linkage prior to modification.
3
Run `gcloud billing projects link corp-analytics-prod --billing-account=01A2B3-4C5D6E-7F8901`
Links the target project to the specified billing account.
This is the primary administrative step required to associate the Google Cloud project with the new billing account using least-privilege roles (`roles/billing.projectManager` on the project and `roles/billing.user` on the billing account).
4
Run `gcloud billing projects describe corp-analytics-prod`
Outputs `billingAccountId: 01A2B3-4C5D6E-7F8901` and `billingEnabled: true`.
Verification confirms that the asynchronous or synchronous binding completed successfully and billing status remains active.

Key Concept

Managing Google Cloud project billing account links via `gcloud billing projects` CLI commands requires appropriate IAM roles (`roles/billing.projectManager` or `roles/billing.admin` on project, and `roles/billing.user` on billing account) and proper operational sequence.
Question 183Question →

A Cloud Engineer is tasked with setting up a new production workload environment in Google Cloud. The workload requires creating a new project named `analytics-prod-99` inside an existing folder named `Production` (Folder ID: `987654321`), linking it to the organization's Cloud Billing Account (ID: `01A2B3-4C5D6E-7F8901`), enabling the Compute Engine API, and assigning the predefined Compute Admin role (`roles/compute.admin`) to the Operations group (`[email protected]`). Arrange the `gcloud` CLI commands in the correct logical order required to execute this end-to-end configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) Create the project inside the target folder, 2) Link the project to the billing account, 3) Enable the Compute Engine API on the project, and 4) Grant the predefined Compute Admin IAM role to the operations group.
The proper administrative sequence mandates creating the resource hierarchy node first (`gcloud projects create --folder`), establishing billing association (`gcloud billing projects link`), activating required API endpoints (`gcloud services enable`), and finally applying scoped predefined IAM roles (`gcloud projects add-iam-policy-binding`).

Step-by-Step Solution

1
Provision the project under the resource hierarchy
Project `analytics-prod-99` is created directly beneath Folder ID `987654321`.
Google Cloud resources must be instantiated in the hierarchy before target-specific project configurations can be performed.
2
Link the billing account to the newly created project
Billing account `01A2B3-4C5D6E-7F8901` is linked to `analytics-prod-99`.
Google Cloud service APIs (like Compute Engine) require an associated billing account to consume paid cloud resources.
3
Enable required API services for the project
The `compute.googleapis.com` API service is enabled for `analytics-prod-99`.
Services must be explicitly enabled on a billed project before their corresponding APIs and infrastructure resources become manageable.
4
Apply IAM policy bindings for administrative access
The `[email protected]` group receives the `roles/compute.admin` role on `analytics-prod-99`.
Granting predefined roles adhering to least privilege follows service enabling so users can manage the enabled compute resources.

Key Concept

GCP Project Provisioning and Hierarchy Setup Sequence
Question 184Question →

A developer attempts to associate a Google Cloud project with an existing corporate Cloud Billing account using the gcloud command line interface, but receives a permission denied error referencing the billing account resource. Following the principle of least privilege, which predefined IAM role must be granted to the developer on the Cloud Billing account to allow project linking?

Show answer & explanation

Answer: Billing Account User (roles/billing.user)

Answer

Billing Account User (roles/billing.user)
The Billing Account User role (`roles/billing.user`) provides the precise permission required to associate projects with a Cloud Billing account while preventing unauthorized administrative changes to billing settings.

Step-by-Step Solution

1
Identify the required operation and resource boundary
The user is attempting to link a project to a Cloud Billing account.
Linking requires appropriate IAM permissions on both the target project and the Cloud Billing account resource.
2
Determine the least-privileged role for the Cloud Billing account resource
The `roles/billing.user` role provides `resourcemanager.projects.createBillingAssignment` on the billing account.
This grants the capability to use the billing account to back a project without allowing modification of payments, billing account structure, or administrative policies.

Key Concept

Configuring Billing Accounts and Linking Projects
Estimated Time:45s
Question 185Question →

A platform engineer needs to configure a project named `app-backend-dev` so that an automated deployment pipeline can manage the Cloud Translation API and request higher rate limits for translation requests. Place the administrative steps in the correct sequential order from first to last to complete this configuration following Google Cloud security and operational best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of operations is: 1) Grant the Service Usage Admin role to the service account on project app-backend-dev, 2) Execute gcloud services enable translate.googleapis.com --project=app-backend-dev, 3) Execute gcloud services list --enabled --project=app-backend-dev to verify API state, 4) Navigate to Service Usage > Quotas in the Google Cloud Console and submit a quota increase request.
To manage Cloud Service APIs and request higher quotas in Google Cloud, the principal must first be granted the appropriate IAM role (`roles/serviceusage.serviceUsageAdmin`). Next, the API (`translate.googleapis.com`) must be enabled within the target project context using `gcloud services enable`. After verifying that the service status is active with `gcloud services list --enabled`, the administrator can request a quota limit increase under Service Usage > Quotas in the Google Cloud Console.

Step-by-Step Solution

1
Assign IAM roles for API administration
The identity receives `serviceusage.services.enable` and associated API administration privileges on the target project.
Without least-privilege IAM permissions like Service Usage Admin, subsequent API enablement commands will be denied with permission errors.
2
Enable the Cloud Translation API using gcloud CLI
The target project `app-backend-dev` provisions resources to allow requests to `translate.googleapis.com`.
Service APIs are disabled by default in new projects and must be explicitly enabled before consumption or quota requests.
3
Verify API activation status
The output confirms `translate.googleapis.com` is present in the list of enabled services.
Validating enablement prevents automated deployment scripts from failing when calling uninitialized API endpoints.
4
Submit a quota increase request in the GCP Console
Google Cloud Support receives the request to raise the default rate limits for the active API metric.
Quota increases apply to enabled services and require administrative submission through the Service Usage Quotas interface.

Key Concept

API Enablement and Quota Management Workflow
Estimated Time:2m 0s
Question 186Question →

A renewable energy enterprise is planning the Google Cloud Compute Engine architecture for two distinct operational workloads:
1. A primary grid telemetry routing engine that runs continuously 24/7, handles live stateful transactions, and must maintain a strict uptime SLA without unexpected termination.
2. An asynchronous nightly batch data processing pipeline that converts raw sensor logs into aggregated daily analytics; the pipeline supports native application checkpointing and can resume execution seamlessly if interrupted.

You need to design a Compute Engine deployment strategy that minimizes overall operational cost while adhering to the SLA and fault-tolerance requirements of each workload. Which TWO recommendations should you implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the 24/7 grid telemetry routing engine on standard Compute Engine virtual machines and purchase Committed Use Discounts (CUDs) for the baseline capacity.; Provision the nightly batch data processing pipeline using Spot Virtual Machines (VMs) to take advantage of deeply discounted compute pricing for fault-tolerant tasks.

Answer

The correct recommendations are to deploy the 24/7 grid telemetry engine on standard virtual machines using Committed Use Discounts for predictable baseline capacity, and to run the nightly checkpoint-supported batch process on Spot Virtual Machines to maximize cost efficiency.
For continuous 24/7 stateful workloads with strict SLAs, standard VM instances backed by Committed Use Discounts provide guaranteed capacity and significant cost reduction. For fault-tolerant batch workloads that support checkpointing, Spot VMs provide deep cost discounts while allowing the system to handle any potential instance preemptions gracefully.

Step-by-Step Solution

1
Analyze the availability requirement of the 24/7 stateful telemetry routing engine.
The continuous SLA and stateful nature require non-interruptible standard instances.
Interruptible instances (Spot VMs) risk breaking uptime SLAs due to sudden preemption.
2
Select the cost-optimization mechanism for the 24/7 baseline continuous workload.
Apply Committed Use Discounts (CUDs) for 1 or 3 years.
CUDs significantly reduce cost for steady-state compute workloads without affecting VM availability.
3
Evaluate the fault-tolerance characteristics of the nightly batch analytics process.
The workload supports native checkpointing and asynchronous retry logic.
Since state can be recovered after interruption, Spot VMs are ideal for minimizing compute expenditure.

Key Concept

Compute Engine Workload Planning: Spot VMs for Fault-Tolerant Batch Workloads vs Committed Use Discounts for Steady-State 24/7 Workloads
Question 187Question →

A financial analytics company is migrating two backend processing workloads to Google Cloud serverless platforms to eliminate server management overhead:

1. Workload 1: A real-time market data streaming microservice packaged as a custom container image that requires persistent WebSocket connections and needs to process up to 80 concurrent client requests per container instance.
2. Workload 2: A lightweight audit logging script that must execute automatically whenever a new transaction report file is uploaded to a Cloud Storage bucket.

Which TWO architectural choices should the cloud engineering team select to satisfy these workload requirements efficiently? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Deploy Workload 1 to Cloud Run, because it supports custom container images, persistent WebSockets, and configurable request concurrency per instance.; Deploy Workload 2 to Cloud Functions (2nd gen) configured with an Eventarc Cloud Storage trigger to automatically execute code upon file creation.

Answer

The correct architectural choices are deploying Workload 1 to Cloud Run (supporting custom containers, WebSockets, and concurrency) and deploying Workload 2 to Cloud Functions 2nd gen (handling event-driven Cloud Storage triggers directly).
Cloud Run is optimal for Workload 1 because it natively runs custom container images, supports persistent connections like WebSockets, and handles multiple concurrent requests per instance. Cloud Functions (2nd gen) is optimal for Workload 2 because it offers direct integration with Cloud Storage bucket events via Eventarc to execute lightweight code snippets serverlessly.

Step-by-Step Solution

1
Analyze the requirements for Workload 1
Identified requirements: custom container image, persistent WebSockets, and multiple concurrent requests per instance.
Cloud Run is built on Knative/containers, supports WebSockets out of the box, and allows configuring concurrency (up to 250 requests per instance), whereas Cloud Functions 1st gen processes one request per instance.
2
Analyze the requirements for Workload 2
Identified requirements: lightweight snippet, event-driven execution on Cloud Storage uploads.
Cloud Functions (2nd gen) integrates directly with Eventarc to handle Cloud Storage events serverlessly without requiring polling or virtual machine management.
3
Evaluate the architectural combinations
Cloud Run for Workload 1 and Cloud Functions (2nd gen) for Workload 2 provide the optimal serverless setup.
This combination minimizes operational overhead while matching the specific execution model and protocol needs of each service.

Key Concept

Selecting serverless compute paradigms: Cloud Run for containerized HTTP/WebSocket microservices requiring concurrency vs Cloud Functions for event-driven snippet execution.
Question 188Question →

A company is scaling a web application in Google Cloud and attempts to launch additional Compute Engine instances in a target region. The deployment fails with an error indicating that the region's total CPU capacity limit for the project has been reached. Which action should be taken to resolve this limit?

Show answer & explanation

Answer: Submit a quota increase request for the specific compute resource limit in the Google Cloud Console Quotas page.

Answer

Submit a quota increase request for the specific compute resource limit in the Google Cloud Console Quotas page.
Google Cloud resource quotas restrict maximum resource consumption per project or region. To increase these caps, cloud administrators must submit a formal quota increase request through the Cloud Console Quotas page.

Step-by-Step Solution

1
Identify the operational constraint blocking deployment
The failure occurs because the regional CPU resource quota cap for the project has been reached.
GCP enforces project and regional resource quotas to prevent unexpected consumption and manage capacity.
2
Select the standard GCP administrative mechanism for quota adjustments
Submit a quota increase request via the Cloud Console Quotas page.
Quota increases require explicit requests reviewed and approved by Google Cloud.

Key Concept

Managing and Requesting GCP Resource Quotas
Question 189Question →

An enterprise IoT organization is planning the Google Cloud serverless compute architecture for a real-time fleet analytics application. The architecture must support two distinct microservices:

1. Telemetry Streaming Service: Receives high-throughput bi-directional gRPC streaming requests from thousands of connected vehicles simultaneously. It requires a custom-compiled C++ telemetry parsing binary bundled within the execution environment.
2. Audit Logging Service: Executes lightweight Python logic triggered automatically whenever a raw sensor log file is written to a Cloud Storage bucket, extracting metadata and publishing a summary notification without requiring container image build pipelines.

Which of the following architectural decisions should the team select for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the Telemetry Streaming Service to Cloud Run, because Cloud Run supports gRPC HTTP/2 bi-directional streaming, custom container runtimes with arbitrary binaries, and high request concurrency per container instance.; Deploy the Audit Logging Service to Cloud Functions, because it seamlessly handles direct Cloud Storage event triggers and executes code snippets without necessitating custom container management.

Answer

Deploy the Telemetry Streaming Service to Cloud Run due to its native support for custom container images, C++ binaries, gRPC bi-directional streaming, and high concurrency. Deploy the Audit Logging Service to Cloud Functions due to its direct event integration with Cloud Storage and zero-container-management overhead for lightweight code snippets.
Cloud Run is ideal for workloads requiring custom OCI container images with compiled binaries (like C++), HTTP/2 gRPC bi-directional streaming, and configurable concurrency. Cloud Functions is ideal for event-driven snippet deployment triggered by Cloud Storage events where managing container images is undesirable.

Step-by-Step Solution

1
Analyze Telemetry Streaming Service requirements
Identified requirements for custom C++ binary dependencies, gRPC bi-directional streaming, and high concurrency per instance.
Cloud Run accepts custom Docker/OCI container images (enabling C++ binaries) and supports HTTP/2 gRPC streaming with up to 250 concurrent requests per container instance.
2
Analyze Audit Logging Service requirements
Identified requirements for Cloud Storage event triggers, simple Python logic, and avoiding container maintenance.
Cloud Functions is designed for simple event-driven code deployment without requiring developers to write Dockerfiles or build/maintain container images.
3
Select the matching architectural decisions
Match Telemetry Streaming to Cloud Run and Audit Logging to Cloud Functions.
This alignment satisfies all operational trade-offs and serverless compute capabilities on GCP.

Key Concept

Selecting Cloud Run vs. Cloud Functions based on containerization, protocol requirements (gRPC/concurrency), and event-driven trigger patterns.
Question 190Question →

A healthcare enterprise is designing a Google Cloud Storage strategy for two distinct data workloads with strict SLA and compliance requirements:

1. Active Diagnostic Images: Files are uploaded daily and accessed constantly by clinicians during the first 30 days. Afterwards, access drops sharply to once every 3 to 6 months for historical audits over a 3-year total retention window.
2. System Compliance Logs: Files are generated continuously, accessed fewer than once per year (only during unpredictable regulatory audits), and required by law to be preserved for exactly 365 days before permanent deletion.

To minimize total cost of ownership—taking into account storage rates, data retrieval fees, and minimum storage duration penalties—which TWO storage configurations should the engineering team implement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Ingest active diagnostic images into Standard storage, and use Object Lifecycle Management to transition them to Coldline storage after 30 days.; Ingest system compliance logs directly into Archive storage, and use Object Lifecycle Management to delete objects after 365 days.

Answer

The optimal strategy is to store active diagnostic images in Standard storage for 30 days before transitioning to Coldline storage via Object Lifecycle Management, and store compliance logs directly in Archive storage with a lifecycle rule to delete objects after 365 days.
The correct strategy combines Standard storage for active reads during the initial 30 days, transitioning to Coldline storage for quarterly access patterns, while utilizing Archive storage for multi-month compliance logs to achieve the lowest at-rest storage rate without incurring early deletion penalties.

Step-by-Step Solution

1
Analyze access patterns and retrieval cost penalties for the diagnostic images workload.
Frequent access during the first 30 days requires Standard storage to avoid high data retrieval fees. Subsequent access once every 3 to 6 months matches Coldline storage (designed for data accessed at most once per 90 days with a 90-day minimum duration requirement).
Choosing Archive or Coldline upfront for frequently read data creates massive operational retrieval costs.
2
Analyze access patterns and minimum duration requirements for the compliance logs workload.
Infrequent access (< 1/year) and a mandatory 365-day retention window align perfectly with Archive storage, which provides the lowest at-rest cost per GB and requires a 365-day minimum storage commitment.
Deleting Archive objects before 365 days incurs early deletion charges equal to the remaining duration up to 365 days; keeping them for 365 days avoids early deletion fees completely while fulfilling compliance.
3
Synthesize the optimal lifecycle configuration.
Standard -> Coldline at 30 days for images, and direct Archive deployment with deletion at 365 days for logs.
This combination minimizes both monthly storage costs and access/retrieval penalty fees.

Key Concept

Cloud Storage Class Selection & Lifecycle Planning
Estimated Time:2m 0s
Question 191Question →

An online gaming company is designing its Google Cloud compute architecture for two core backend services with distinct requirements:

1. Service A: A stateless containerized microservice that handles incoming REST API player requests, experiences unpredictable traffic spikes, and requires zero cluster node administration with the ability to scale to zero instances.
2. Service B: A legacy physics engine that requires custom Linux kernel patches and direct root access to the host virtual machine operating system.

Which TWO compute strategies should the cloud engineer choose to meet these requirements with optimal operational efficiency? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy Service A on Cloud Run to leverage fully managed serverless container execution with automatic scaling to zero.; Deploy Service B on Compute Engine Virtual Machines to support direct access to the host OS and custom kernel module installations.

Answer

Deploy Service A on Cloud Run and deploy Service B on Compute Engine Virtual Machines.
Cloud Run provides serverless container management for stateless HTTP services with zero node overhead and scale-to-zero capabilities. Compute Engine virtual machines provide Infrastructure-as-a-Service access, allowing arbitrary OS-level customization and custom Linux kernel patches.

Step-by-Step Solution

1
Analyze Service A requirements
Service A requires running a stateless container, zero node management, handling unpredictable HTTP traffic, and scaling to zero.
Cloud Run provides serverless container execution that scales down to zero instances when idle and abstracts away infrastructure management completely.
2
Analyze Service B requirements
Service B requires custom OS kernel patches and direct root level access to the underlying virtual machine OS.
Compute Engine VMs offer complete control over the guest OS kernel and system configuration, which managed container platforms restrict.
3
Evaluate and reject invalid options
Cloud Functions is unsuitable for complex container microservices; GKE Autopilot prevents custom node kernel modifications; Spot VMs are intended for fault-tolerant workloads due to preemption.
Matching workload constraints precisely prevents operational failure and unexpected architectural limitations.

Key Concept

Selecting GCP Compute Services Based on Workload Constraints and OS Requirements
Question 192Question →

An enterprise organization is restructuring its Google Cloud environment to establish proper governance and centralized resource management. A cloud engineer is tasked with migrating a standalone GCP project into a newly established 'Finance-Prod' folder beneath the Organization node, linking it to the organization's central billing account, and enforcing resource configuration constraints. Arrange the administrative steps in the correct chronological order to complete this deployment while following Google recommended best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with provisioning the destination folder under the Organization root, moving the standalone project into that folder, linking the project to the designated billing account, enforcing the required Organization Policy constraint at the folder level, and finally verifying that the project correctly inherits the effective policy constraints.
The correct operational order follows the logical dependency tree of Google Cloud resource hierarchy creation: first establish the parent container (folder under organization), second move the child resource (project into folder), third establish financial linkage (link billing account), fourth apply policy constraints at the container node (folder organization policy), and fifth audit effective inherited governance at the leaf level (project policy evaluation).

Step-by-Step Solution

1
Provision the destination folder within the resource hierarchy
The 'Finance-Prod' folder is created under the Organization node.
Projects cannot be moved into non-existent hierarchy containers.
2
Relocate the standalone project to the new parent folder
The project is nested beneath the 'Finance-Prod' folder node.
Placing the project into its intended folder ensures it receives appropriate hierarchical governance.
3
Link the project to the centralized Billing Account
Project resource consumption is billed to the central billing account.
Billing accounts must be attached to projects to enable paid GCP services under organization management.
4
Apply Organization Policy constraints at the folder level
The policy constraint is set on the 'Finance-Prod' folder.
Applying policies at the folder level enforces uniform security rules across all current and future projects in that folder via inheritance.
5
Inspect effective policy evaluations at the project level
Confirmation that inherited folder rules apply to the project.
Validation ensures inheritance rules function as designed without conflicting local overrides.

Key Concept

GCP Resource Hierarchy Lifecycle & Policy Inheritance Sequence
Question 193Question →

A cloud engineer is designing the Compute Engine architecture for an enterprise web service that must run continuously 24/7 without interruption. The application requires a customized resource allocation of exactly 6 vCPUs and 27 GB of RAM to operate efficiently. Which Compute Engine configuration strategy should be selected for this workload?

Show answer & explanation

Answer: Provision standard Compute Engine instances with a Custom machine type using standard (non-spot) VMs.

Answer

Provision standard Compute Engine instances with a Custom machine type using standard (non-spot) VMs.
Choosing standard Compute Engine VMs configured with a Custom machine type satisfies both the specific non-standard vCPU/memory ratio (6 vCPUs and 27 GB RAM) and the requirement for continuous 24/7 uptime without risk of unexpected preemption.

Step-by-Step Solution

1
Analyze workload availability requirements.
The application requires continuous 24/7 availability without interruption.
Spot/Preemptible VMs can be reclaimed by GCP at any time and are not suitable for non-fault-tolerant continuous services.
2
Analyze resource sizing requirements.
The application needs a specific non-standard ratio of 6 vCPUs and 27 GB RAM.
Custom machine types allow tailoring CPU and memory precisely to workload needs, preventing waste from overprovisioned predefined sizes.

Key Concept

Selecting Custom Machine Types and Standard VM Provisioning for Continuous Workloads
Question 194Question →

An administrator grants a cloud engineer the Viewer (roles/viewer) role on a Google Cloud folder named 'Development'. The folder contains three environment projects. The administrator attempts to restrict access by removing the Viewer role from the engineer specifically on one of the child projects. Which statement correctly describes the outcome of this action?

Show answer & explanation

Answer: The engineer retains Viewer access to the child project because IAM policies are additive and inherited parent permissions cannot be revoked at a lower resource level.

Answer

The engineer retains Viewer access to the child project because IAM policies are additive and inherited parent permissions cannot be revoked at a lower resource level.
In the Google Cloud resource hierarchy, IAM policies are inherited downward from Organization to Folders and then to Projects. Because IAM policy evaluation is strictly additive, permissions granted at a parent level are automatically effective on all child resources and cannot be restricted or revoked at a lower level.

Step-by-Step Solution

1
Identify where the permission was granted in the resource hierarchy.
The Viewer role was granted at the parent Folder level ('Development').
In GCP, permissions granted at higher resource hierarchy nodes (Organization > Folder > Project) flow downward to all contained child resources.
2
Determine how policy inheritance operates when attempting to modify permissions at a child node.
Attempting to remove the role binding at the child project level does not affect inherited permissions.
Google Cloud IAM policies are strictly additive. Inherited permissions cannot be denied or revoked at a child resource level.

Key Concept

Resource Hierarchy IAM Policy Inheritance
Question 195Question →

An enterprise financial institution is designing the Compute Engine infrastructure for two core workloads:
1. A mission-critical, stateful transaction processing service that operates continuously 24/7 with a predictable high-memory footprint and zero tolerance for unexpected instance terminations.
2. An overnight Monte Carlo risk simulation batch engine that executes thousands of independent, stateless calculation tasks with native checkpointing.

Which TWO provisioning and cost-optimization strategies should you recommend to minimize operational costs while satisfying all SLA requirements? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Purchase 3-year Committed Use Discounts (CUDs) for the baseline compute capacity required by the stateful transaction processing service.; Provision the Monte Carlo risk simulation batch engine using Spot Virtual Machines across multiple availability zones.

Answer

The optimal architecture combines purchasing 3-year Committed Use Discounts (CUDs) for the 24/7 stateful transaction processing service and provisioning the Monte Carlo risk simulation batch engine using Spot Virtual Machines.
Purchasing Committed Use Discounts (CUDs) provides deep savings for baseline 24/7 stateful workloads without risking node preemption, while Spot VMs provide maximum cost reduction (60-91%) for fault-tolerant overnight batch jobs that support native checkpointing.

Step-by-Step Solution

1
Analyze workload characteristics and SLA requirements for the transaction processing service.
The service is 24/7, stateful, has a predictable compute/memory profile, and cannot tolerate unexpected preemption.
Steady-state uninterruptible workloads qualify for Committed Use Discounts (CUDs), yielding up to 70% cost reduction without operational risk.
2
Analyze workload characteristics and fault-tolerance for the Monte Carlo simulation batch engine.
The engine is stateless, runs periodically/overnight, supports checkpointing, and tolerates node interruptions.
Fault-tolerant batch jobs with checkpointing are ideal candidates for Spot VMs, which offer deep discounts of 60% to 91% compared to standard pricing.
3
Evaluate and eliminate non-optimal or risky compute options.
Using Spot VMs for stateful zero-downtime services risks application failure, while using standard VMs with Sustained Use Discounts for intermittent batch jobs yields suboptimal savings.
Spot VMs can be revoked with a 30-second notice, and Sustained Use Discounts require prolonged continuous execution on standard instances.

Key Concept

Selecting Compute Engine purchasing and provisioning models based on workload persistence and availability SLAs
Question 196Question →

A site reliability engineer is task-driven to scale up an enterprise AI workspace in Google Cloud by increasing the regional GPU quota for a specific production project. The project currently operates under strict security controls where least privilege and proper quota management workflows must be maintained. What is the correct sequence of administrative steps required to successfully submit this quota increase request using the Google Cloud Console?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with verifying adequate IAM quota permissions, navigating to IAM & Admin > Quotas & System Limits in the GCP Console, filtering for the target regional GPU resource metric, selecting the item to click Edit Quotas, and concluding with specifying the desired limit along with a business justification before submitting the request.
The workflow follows logical administrative security and operational steps in GCP. First, IAM rights must be established to avoid permission failure. Next, navigating to the Quotas page allows the administrator to filter and locate the specific regional GPU metric. Once selected, initiating the edit form and providing a clear operational justification allows Google Cloud to process the request.

Step-by-Step Solution

1
Confirm IAM permissions
Ensures the user has the roles/servicemanagement.quotaAdmin role or serviceusage.quotas.update permission.
Quota modifications require administrative permissions at the project or organization level.
2
Access Quotas page
Opens IAM & Admin > Quotas & System Limits in the GCP Console.
This is the primary location for viewing current usage and requesting higher resource limits.
3
Filter metrics
Isolates the specific regional GPU quota metric.
Quotas are enforced per region/zone and service; precise filtering avoids requesting adjustments on the wrong resource.
4
Initiate edit workflow
Opens the quota edit side panel after clicking Edit Quotas.
Enables form fields for target limit inputs.
5
Submit request
Inputs new limit and justification, then submits to Google Cloud Support.
Requests above default thresholds require rationale for approval by Google quota engineering teams.

Key Concept

Standard administrative workflow for viewing and requesting regional GCP resource quota increases in the Google Cloud Console.
Question 197Question →

An organization is architecting two backend workloads for an e-commerce platform on Google Cloud:

1. Component 1: A lightweight, event-driven task triggered by file uploads to Cloud Storage that extracts image metadata in under 5 seconds.
2. Component 2: A web-facing invoice rendering service requiring custom Linux dynamic C++ system libraries, WebSocket support, and handling up to 80 concurrent HTTP requests per instance.

Which two deployment strategies represent the optimal serverless compute choices for these components on Google Cloud? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Component 1 to Cloud Functions (2nd gen) using an Eventarc trigger for Cloud Storage events.; Deploy Component 2 to Cloud Run packaged inside a custom container image.

Answer

Deploy Component 1 to Cloud Functions (2nd gen) using an Eventarc trigger for Cloud Storage events, and deploy Component 2 to Cloud Run packaged inside a custom container image.
Cloud Functions (2nd gen) is designed for event-driven snippet execution integrated with Cloud Storage via Eventarc. Cloud Run is designed for containerized applications, supporting custom binaries, dynamic system libraries, WebSockets, and multi-concurrency (up to 250 concurrent requests per instance).

Step-by-Step Solution

1
Analyze Component 1 requirements
Component 1 is short-lived (< 5 seconds) and triggered by Cloud Storage object creation events.
Cloud Functions (2nd gen) seamlessly integrates with Eventarc for Cloud Storage events, making it the most operational-efficient serverless choice.
2
Analyze Component 2 requirements
Component 2 requires a custom C++ runtime with specific OS libraries, WebSocket connections, and high HTTP concurrency (80 requests per container instance).
Cloud Run natively supports custom container images containing any binary/library dependencies, supports WebSockets, and handles concurrent requests per container instance.

Key Concept

Selecting serverless compute options between Cloud Run and Cloud Functions based on execution paradigm, container customizability, event integration, and concurrency requirements.
Question 198Question →

A cloud engineer is configuring a dedicated deployment service account that will automate project setup. The service account needs to enable and disable Google Cloud APIs (such as Compute Engine API and Cloud Run API) within a targeted project named `app-deploy-prod`. Following Google Cloud best practices for the principle of least privilege, which predefined IAM role should be assigned to the service account on the `app-deploy-prod` project?

Show answer & explanation

Answer: Service Usage Admin (roles/serviceusage.serviceUsageAdmin)

Answer

Service Usage Admin (roles/serviceusage.serviceUsageAdmin)
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role grants full administrative access to enable, disable, inspect, and audit service usage and APIs within a target project while upholding the principle of least privilege.

Step-by-Step Solution

1
Identify the required functional capability
The requirement asks for enabling and disabling Cloud Service APIs within a target project.
API administration requires specific `serviceusage.services.enable` and `serviceusage.services.disable` permissions.
2
Evaluate candidate IAM roles against the Principle of Least Privilege
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) contains the exact permissions needed to enable and disable service APIs without granting broader resource modification capabilities.
Primitive roles like Editor or high-level resource manager roles like Organization Admin grant excessive permissions.

Key Concept

Enabling Cloud Service APIs using Predefined IAM Roles and Least Privilege
Question 199Question →

A web application frequently serves user profile images to active website visitors on a daily basis. Which Google Cloud Storage class is best suited for this workload to ensure low-latency access and minimize data retrieval costs?

Show answer & explanation

Answer: Standard Storage

Answer

Standard Storage is the optimal choice for active, frequently accessed assets because it carries zero data retrieval charges and provides high performance.
Standard Storage is optimal for high-frequency access ('hot' data) like live website assets because it charges no retrieval fees and offers maximum performance.

Step-by-Step Solution

1
Identify the data access pattern in the scenario.
The profile images are accessed daily by active users.
Cloud Storage classes are selected primarily based on how frequently data will be read and retrieved.
2
Compare storage class costs and retrieval penalties for frequent access.
Standard Storage has no retrieval fees and no minimum retention period, whereas Nearline, Coldline, and Archive storage incur per-GB data retrieval fees.
For frequently accessed data, retrieval fees in colder tiers rapidly outweigh any at-rest storage savings.

Key Concept

Selecting Cloud Storage classes based on data access frequency and retrieval cost trade-offs.
Question 200Question →

A finance team asks an IT support analyst to link a standalone project (`app-backend-dev`) to the corporate Cloud Billing account. Applying Google Cloud's principle of least privilege, which TWO predefined IAM roles must be granted to the analyst to complete this task? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Billing Account User (`roles/billing.user`) on the target Cloud Billing account; Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the target Google Cloud project

Answer

To link a Google Cloud project to an existing Cloud Billing account following least privilege, the analyst requires the Billing Account User role on the billing account and the Project Billing Manager role on the project.
Successfully linking a Google Cloud project to a billing account requires explicit IAM authorization on both resources: the Billing Account User role on the billing account and the Project Billing Manager role on the project.

Step-by-Step Solution

1
Determine the required permission on the Cloud Billing account
The Billing Account User role (`roles/billing.user`) grants permission to associate projects with the billing account.
Associating a project consumes billing capacity on the billing account, requiring explicit authorization from the billing resource.
2
Determine the required permission on the Google Cloud project
The Project Billing Manager role (`roles/resourcemanager.projectBillingManager`) grants permission to link or unlink the project to a billing account.
Attaching a billing account changes the project's financial association, requiring authorization on the project resource.

Key Concept

Linking a project to a Cloud Billing account requires simultaneous least-privilege predefined roles on both the billing account resource (`roles/billing.user`) and the project resource (`roles/resourcemanager.projectBillingManager`).
PreviousPage 10 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin